Workshop · 2
Timestomping
Every file on NTFS carries its times twice. The copy that is easy to change is the one every tool shows; the other one is how you catch the change.
Written for Mutant v2.6.1. Every program and output on this page is that release’s own file.
Preview. This module is not published yet: it opens once every builtin it uses has cleared review at the pinned release.
beginner
Two clocks
$STANDARD_INFORMATION and $FILE_NAME, and the file that says it was created before it was given its name.
The clock that is easy to change
CurrentAnti-forensics tools rewrite file times so a file planted yesterday looks years old. The times they rewrite are the ones Explorer and most tools show.
NTFS keeps a second set, written when the file’s name is made, that the usual tools leave alone. When the two disagree in a way that cannot happen naturally, the file was edited.
From the desktop to the record
LockedFinish or skip the stage above to open this one.
One record, two clocks
LockedFinish or skip the stage above to open this one.
Catch it with Mutant
LockedFinish or skip the stage above to open this one.
Build it
LockedFinish or skip the stage above to open this one.
Check yourself
LockedFinish or skip the stage above to open this one.
intermediate
Contradictions in the timeline
Two tests over a bodyfile: a file modified before it existed, and a file the timeline names that is not on disk.
Which times cannot be true
LockedFinish or skip the stage above to open this one.
Check yourself
LockedFinish or skip the stage above to open this one.
Run them yourself
LockedFinish or skip the stage above to open this one.